CVE-2022-40276
Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Zettlr. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.
- Score
- CVSS 3.1 5.5 Medium
- Status
- Modified - help@fluidattacks.com
- Published
- 2022-11-03
- Last modified
- 2025-05-02
- Weaknesses
- CWE-20
Affected products
References
- https://fluidattacks.com/advisories/avicii/
- https://github.com/Zettlr/Zettlr
